Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-07
Testing for Cross-Origin Resource Sharing (CORS)
Passed 20 of 22 test cases with the skill, and 19 of 22 without it.
1 fixed19 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
How can an auditor use cURL to test if an API endpoint at https://api.example.com/user reflects dynamic origins or accepts null origins?
| Checked | Without skill | With skill |
|---|---|---|
| Uses the cURL header option to supply custom Origin values. | Passed | Passed |
| Filters response output for access control headers. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-07
Testing for Cross-Origin Resource Sharing (CORS)
CORS is a browser mechanism that allows controlled access to resources from different origins. Misconfigured CORS policies can allow malicious websites to read sensitive data from authenticated users, leading to data theft.
#!/bin/bash
TARGET="https://target.com/api/user"
# Test with attacker origin
curl -sI -H "Origin: https://evil.com" "$TARGET" | grep -i "access-control"
# Test with null origin
curl -sI -H "Origin: null" "$TARGET" | grep -i "access-control"
test cases passed, vs 19 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.